ci: reduce superseded validation and dependency downloads

[Coding-Dev-Tools]

Superseded PR heads currently finish the full validation matrix after a newer head starts. Cancel obsolete PR validation in CI, CodeQL and offline-evidence export while giving every main push, scheduled run and manual run an independent concurrency group.

Reuse pip/npm download caches keyed by the dependency manifests, bound previously unbounded jobs, and retain routine candidate-journey diagnostics for 14 days. Release artifacts, release evidence, qualification writers and protected benchmark workflows keep their existing retention and serialization. All test commands, security scans, Python/OS matrices, conditions and triggers remain intact; clean installs and independent distribution builders still execute.

Published head 0a4a89d2cae98ad023273a71c2c1b416ec7b69da incorporates qualified main 4cd10f1e5e1092db74380652e5e123aa32a3ba61 through an ordinary two-parent merge with no conflicts or manual resolutions. Its tree is 91d4d2b3214d05a3772102a36f589c2b4c68084e. Only the five reviewed workflows differ from that primary tree; all 1,998 other tracked objects and modes, 587 official producer bindings, 700 evidence assets and 29 runtime assets are preserved. Two independent structural reviews confirmed that preservation and all allowed workflow changes. Fresh local validation on this exact head passed all 69 maintained release/workflow guards with zero failures, errors, skips or network attempts; whitespace checks passed.

Fresh hosted validation on this exact head completed successfully: all 30 checks, 29 actual workflow jobs and three workflow runs passed. Python 3.10 passed 10,174 tests with 24 expected skips; Python 3.11–3.14 each passed 10,176 with 22 expected skips. The Python 3.9 NumPy-only floor passed 8,021 with 423 expected extra/platform skips, and the browser suite passed 284. The maintained Python 3.11 coverage job passed 10,176 tests with 22 skips and measured 86.63% statement coverage against its unchanged 60% gate; it does not enable branch coverage. Linux, Windows and macOS installed MCP/server journey artifacts were independently checked against their actual package/source bindings. The tested PR merge commit c204358d4f2cc66ea4cb004893ccfea36e8c4531 has parents 4cd10f1e5e1092db74380652e5e123aa32a3ba61 and 0a4a89d2cae98ad023273a71c2c1b416ec7b69da, and exactly the qualified tree above.

These are new executions for this published integration head; earlier original-cost-head and Core release results remain historical. Merge uses the repository's allowed squash method, preserving the qualified complete tree. No protection or review requirement is waived, and no direct release publication, provider or deployment action is part of this change.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-18T10:30:25.237668Z	0a4a89d	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.